99 Commits

Include renames

Author	SHA1	Message	Date
admin	48dff2078e	fix(admission): zero maximumCredits means pilot mode, not a missing reservation ... The structure route ran the model with maximumCredits=1 and no reservation when credits were off, so admission returned reservation_required and the route answered 502. Admission now requires a reservation only when maximumCredits>0. Verified against the live stack: DOC0 segments -> LiteLLM/Ollama (inf0-valuation) -> evidence validation -> needs_review (no export).	2026-11-02 16:42:01 +01:00
admin	e93db5fc1f	fix(doc0): call DOC0 as the granted service actor ... DOC0 denies an x-actor-id that the service identity has no actor_grant for, so every upload/structure call from 0pt failed with DOC0_ACCESS_DENIED and became outcome_unknown. The journal and project authorization keep the verified end-user actor; only the DOC0 request acts as the service (DOC0_SERVICE_ACTOR_ID).	2026-11-02 16:17:29 +01:00
admin	e3c4bc28c3	feat(workbench): live LiteLLM gateway adapter + explicit project grants ... - createInf0Gateway prefers the live OpenAI-compatible LiteLLM gateway and falls back to the native INF0 surface; admission stays local and fail-closed. - Project authorization: OpenFGA when configured, otherwise a validated server-owned OPT_PROJECT_GRANTS list (deny by default). - Tests for the gateway adapter, the factory and grants.	2026-11-02 14:50:50 +01:00
admin	b3239487b7	feat(document-workbench): wire customer upload, structuring, credits and readiness ... - POST /api/0pt/documents/upload: real multipart bytes into DOC0 through the durable attempt journal and the existing coordinator; verified tenant/actor only, project authorization fail-closed. - POST /api/0pt/documents/structure: DOC0 segments -> INF0 -> evidence-bound validation -> optional JSON/CSV export, with credit reserve/settle. - Credits: balance, server-owned price book, Stripe Checkout and idempotent webhook reconciliation via a Stripe re-read of session + payment intent. - /portal/dokument and /portal/krediter: SIAX-styled workspace. - @siax/access: universal, framework-neutral OpenFGA project relationship primitive reusable by DOC0/N0D/other products. - Readiness: real Redis PING probe instead of presence-only; queue is now a live dependency when configured. - Dockerfile: copy every workspace manifest so --frozen-lockfile works. - Format/build hygiene: .prettierignore, .worktrees ignored, valid manifest YAML.	2026-11-02 14:46:10 +01:00
admin	d56ccbb542	feat: validate and export evidenced document batches	2026-11-02 08:37:11 +01:00
admin	c1244a298c	fix: bind DOC0 upload receipts to original request	2026-11-02 08:24:18 +01:00
admin	243c45c0f2	Merge pull request 'Enforce tenant isolation for document credit storage' (#422) from codex/credit-ledger-tenant-rls into main	2026-11-02 06:41:36 +00:00
admin	0f734297ce	fix: enforce tenant isolation on credit storage	2026-11-02 07:39:35 +01:00
admin	da5a7f403e	fix: bind model results to immutable evidence and policy	2026-11-02 07:34:47 +01:00
admin	ce41d601f7	feat: coordinate journaled document upload attempts	2026-11-02 07:17:32 +01:00
admin	47e0264571	fix: stabilize DOC0 upload fingerprint metadata	2026-11-02 06:52:50 +01:00
admin	cf37a66d35	feat: persist scoped document upload attempts	2026-11-02 03:48:13 +01:00
admin	f79853d156	feat: inspect document upload journal from 0pt	2026-11-02 03:06:56 +01:00
admin	eec8cb2396	feat: validate source-backed decimals and dates	2026-11-02 02:20:54 +01:00
admin	4d56a1dd62	fix: reconcile uncertain document uploads	2026-11-02 02:17:55 +01:00
admin	70b92e2fea	fix: secure document upload transport	2026-11-02 02:09:45 +01:00
admin	daa0a2415f	feat: add evidence-checked document exports	2026-11-02 02:03:48 +01:00
admin	bd1c20edb2	feat: add guarded document workbench foundations	2026-11-02 01:26:36 +01:00
admin	3279fa0533	fix(lint): eslint-undantag på rätt rader — json:any i graph-adapter + require-fixtures ... eslint-disable-next-line gällde nästa rad; json:any-linen behövde eget undantag. npm run lint: 0 errors (8→0). 1141/1141.	2026-09-29 12:50:06 +02:00
admin	1b6140a16a	fix(lint): rotfelsa ärvd lint-skuld — graph-adapter + p0-tester (blockerade #128) ... Parallellsessions-merge lämnade 12 eslint-errors på main (no-explicit-any i graph-mailbox-adapter + 2 p0-tester). Graph-JSON:n är genuint ostrukturerad — medveten, avgränsad eslint-undantag med skäl (DoD §13); p0-testerna typade med Record/cast. Lint 0 errors; tsc grön; 1141/1141.	2026-09-29 12:31:34 +02:00
Claude CodeandClaude Sonnet 5	07158099ee	feat(ingestion): VehIQ OLTP -> ClickHouse watermark extractor (P070) ... Implements Simon's specified pattern (dealer_stock_entry/deal -> watermark/updated_at -> 0pt ingestion -> ClickHouse) as a P061 connector pair (PostgresWatermarkConnector, PostgresKeyedLookupConnector) plugged into the existing P062 IngestionRunner, writing to opt_dataset_projection via SiaxAnalyticsEngine.ingestProjection. Built here, not in admin/vehiq: that repo's own ADR-0035 (decisions 1/2/10, CI-enforced by validate_engine_firewall.py) forbids VehIQ code from ever holding a ClickHouse credential or hammering OLTP directly for analytics. See docs/P070_VEHIQ_OLTP_EXTRACTOR.md for the full rationale. Also corrects a real schema mismatch found while building this: production has no generic `updated_at` on any of the three target tables (verified live, read-only, 2026-09-25). dealer_stock_entry/deal use listed_at/ created_at as insert-time watermarks instead (documented caveat: in-place updates are not caught without a schema change); app.listing has no timestamp column at all and is deliberately not covered yet. Vehicle dimension lookup is narrow by construction: keyed on exactly the vehicle_id set referenced by the batch just read, never a scan of the 98M-row vehiq.vehicle table (connector-level validate() refuses that table by name; runner-level tests assert the query only ever touches referenced IDs). Verified: fixture-backed connector/runner tests (watermark+limit, same-timestamp tie at a page boundary, crash/resume, empty-table case, narrow-lookup query-count assertions) + a real disposable Postgres container (caught two real Date-handling bugs fixtures could not) + a read-only proof against actual production (server10, vehiq-db): the extractor's exact SQL returns zero rows, no error, confirming it is safe to schedule with zero current effect. .gitea/workflows/vehiq-oltp-ingest.yml is present, cron-scheduled, and defaults to VEHIQ_INGEST_MODE=preview (read-only, never writes) with no secrets configured — safe to merge with zero production effect until explicitly activated per the doc's "what activating this requires". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-25 19:11:15 +02:00
Claude Code	dd4731aa3c	feat(decision): Jev ER auto-match shadow (0PT_DECISION_ER_SHADOW) ... Shadow-eval av D0 auto-match: D0-tröskeln förblir auktoritet, kvaliteten mäts fire-and-forget mot siax-decision (:4600, decisionId 0pt.er.auto_match). Gate 0PT_DECISION_ER_SHADOW=1 (OFF by default). Fail-closed: gate-off/fel/ABSTAINED påverkar aldrig det deterministiska svaret; decision-planen loggar inbyggt (AUD0). - packages/decision: erAutoMatchShadow + erAutoMatchShadowEnabled - src/er/comparePair: void erAutoMatchShadow(...).catch(() => null) - tests/p0/decision-er-shadow.test.ts: gate-off/on, POST-body, DECIDED/ABSTAINED, fetch-fel, fire-and-forget-wire (16 nya tester)	2026-09-23 16:53:55 +02:00
admin	f3658e2577	fix(FAS 36): ER-decision-importen via workspace-paketet @siax/0pt-decision (relativ path utanför root bröt Turbopack-builden — pre-existerande bugg från fc1a62b, exponerad av färsk pnpm-install i worktree)	2026-09-23 03:07:57 +02:00
Claude Code	fc1a62bb81	feat: decision-plane wiring — ER-pair decision.match tie-break (@siax/0pt-decision) ... - packages/decision: erMatchDecision (0pt.er.pair_match mot siax-decision :4600) - comparePair async + borderline-band (±0.05 av review_threshold) → decision.match (D1 advisory) — deterministisk status GÄLLER om decision abstainar - OPT_DECISION_ER_ENABLED=1-gate (off tills kalibrering) - tests async-anpassade (await generateCandidates/rejects.toThrowError) - typecheck: 13 fel = pre-existing extraction-route (main-paritet), 0 nya fel - tester: 1108 passed | 184 skipped	2026-09-23 00:15:27 +02:00
admin	655a71ebd7	feat(HSP-085): migration-studio — T01 ej importerbart döljs EJ ur nämnaren (ratio = importable/total), T02 session-resume med tenant-check + checkpoint + resolved conflicts, T03 coverage-claim SCOPED (aldrig komplett M365-ersättning), 8 tester	2026-09-22 22:18:01 +02:00
admin	85b0e6cd72	feat(HSP-084): cutover — T01 detectDualWriters (båda aktiva = STOPPAD), T02 handleLateSourceChanges (carry eller stopp, aldrig tyst förlorad), T03 buildRollbackPlan (targetWritesCarriedBack + käll-writer återaktiveras + konsistensverifiering), 8 tester	2026-09-22 21:00:19 +02:00
admin	45dd7dc6e2	feat(HSP-067): exit-manifest — T01 open formats only (portabel till icke-SIAX-mål), T02 notice-krav följer tillåtna artefakter, T03 nonExportable EXPLIKIT med skäl (aldrig tyst utelämnat), 7 tester	2026-09-22 20:14:20 +02:00
admin	57d5ff36fe	feat(HSP-083): migration-runner — InMemoryCheckpointStore (T02 cursor commit EFTER durable target-ack), idempotent-sink replay-säkerhet (T01 krasch → replay räknad, inga dubbletter), T03 VERIFIED kräver per-partition content-hash (count-only = UNVERIFIED), 6 tester	2026-09-22 16:55:08 +02:00
admin	23d05d9379	feat(HSP-082): migration-mapping — decideEntityMerge (T01 identiska namn EJ ihopslagna utan bevis), transformRecord (T02 åäö byte-exakt + UTC-normalisering med original-offset), aclBlockingCheck (T03 saknad ACL-mappning BLOCKERANDE), 10 tester	2026-09-22 15:37:35 +02:00
admin	c1c7a33d65	feat(HSP-081): discovery-inventory — inventory-report (T01 write-scoped sources EXCLUDED från inventeringen, T02 persondata REDACTED till referenser rekursivt, T03 otillgängliga källor = okända med real fel — aldrig tyst droppade), 6 tester	2026-09-22 15:05:29 +02:00
siax-bot	a049096d4a	Merge pull request 'feat(X-737): Synthetic Data Factory (0pt dataset-truth + INF0-generering)' (#77) from feat/x737-synthetic-factory into main	2026-09-21 11:14:41 +00:00
admin	8411f9759e	feat(X-737): Synthetic Data Factory — sampling→synthesis (INF0-port)→PII/privacy (fail-closed före publish)→quality→dedupe→contamination→deterministisk train/val/test-split; provenance per rad (policy+model+source+sha256). 5/5 tester	2026-09-21 13:07:54 +02:00
admin	a1557b2a7d	feat(payments): bind orders to verified tenant and buyer	2026-09-15 19:53:58 +02:00
admin	17bd1b40a0	feat(0pt): record legitimate-interest stance — B2B contacts, company-linked only ... Recorded decision (Simon 2026-08-31): personal data may be stored under legitimate interest ONLY as business contacts bound to a company/org entity. Gate enforces it: legitimate_interest requires purpose=business_contact and entity_linked_only=true; recordStored() requires entity_id (orgnr/rgs/LEI, hashed) and refuses person-only rows. +1 test; suite 167 pass | 1 skip; typecheck clean.	2026-09-15 02:40:52 +02:00
admin	12080fc517	feat(0pt): PII-Gate GDPR-guardrail for personal-data sources (fail-closed) ... PiiGateService makes any future personal-data source (ratsit.se and other directory domains) technically GDPR-OK before the first byte is stored: - recorded legal basis (art. 6) with basis_ref evidence, no policy => fail-closed - data minimisation via field allowlist (art. 5(1)(c)) - storage limitation + enforceRetention purge (art. 5(1)(e)) - sha256-only identity keys + log redaction (art. 25/32) - accessStatement / erase subject-rights surfaces (art. 15/17) - robots/rate confirmation required for web+api sources; no stealth/bypass - audit trail via AUD0 at risk L3 (0pt.pii_*) - gate enabled by default in SourceQueryService 10 new tests; full suite 166 pass | 1 skip; typecheck (blocking gate) clean.	2026-09-15 02:40:52 +02:00
adminandClaude Sonnet 5	4caf122129	fix(security): add SSRF guard to Fabric/OneLake adapter's sqlEndpoint ... connection_config.sqlEndpoint on POST /api/0pt/sources/{sourceId}/query was passed straight from the request body to the mssql TDS driver as the outbound connection target, with only its http(s):// scheme stripped — no hostname allowlist or private/loopback/link-local/cloud-metadata guard. This route already requires a Zitadel bearer token + tenant match (P014 tenant guard), so this was not anonymously exploitable, but it is the exact SSRF shape found and exploited-in-principle elsewhere in this estate tonight (press0), so it's worth closing as defense-in-depth. Adds src/lib/security/ssrf-guard.ts: resolves the endpoint's hostname and rejects any address in a private/loopback/link-local/cloud-metadata/ unspecified range (RFC1918, 127.0.0.0/8, 169.254.0.0/16 incl. the 169.254.169.254 metadata address, ::1, fc00::/7, fe80::/10, IPv4-mapped IPv6), failing closed on DNS resolution errors. The range-check logic is ported 1:1 from press0's src/lib/security/ssrf-guard.ts built the same night for the same bug class against a fetch()-based URL there; this module's surface differs because sqlEndpoint is a bare host[:port], not a fetchable URL. The DNS lookup is injectable (mirrors this adapter's existing fetchImpl pattern) so tests are hermetic. FabricOneLakeAdapter.getPool() now calls the guard before loadDriver()/ getToken()/opening the TDS pool, so a blocked target never reaches a real outbound connection attempt or spends an AAD token exchange. Tests: new tests/p0/fabric-onelake-ssrf-guard.test.ts unit-tests the guard module directly (range boundaries, IPv4-mapped-IPv6 bypass attempt, fail-closed on DNS failure/empty answer). New adapter-level tests in tests/p0/fabric-onelake-adapter.test.ts prove (a) a private-IP-resolving sqlEndpoint is rejected before fetch/connect is ever called, (b) a literal loopback sqlEndpoint is rejected the same way, and (c) a normal external Fabric hostname still passes the guard and completes the query — the guard doesn't false-block legitimate targets. Existing adapter tests are updated to inject a deterministic DNS resolver so they stay hermetic instead of depending on real DNS. Full suite: 997 passed, 0 failed, 184 skipped (self-skipping realinfra tests with no live backend this run). typecheck and lint clean on all touched files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-11 02:18:23 +02:00
adminandClaude Opus 5	db868f4bdf	fix(prod): close legacy storage fallbacks in orders/subscriptions/blobs ... The `resolveStoreMode` kill switch (Master-DoD §3/§10) covered the newer `src/repositories/*` stores but not two older paths, both of which are live production execution paths today. 1. LEGACY NEXT.JS STORES. `lib/orders-store.ts` and `lib/subscriptions-store.ts` predate `src/platform/dependency-mode.ts` and called `getSql()` directly, silently falling back to module-global `Map`s when no database is configured. For orders, payments and subscriptions that is not a degraded mode, it is invisible loss of money-bearing state: the API returns 201 and the row evaporates on the next restart or on any other replica. The live 0pt deployment (Coolify app 54) runs NODE_ENV=production with DATABASE_URL, POSTGRES_URL and POSTGRES_PRISMA_URL all unset — so this is the behavior in production right now, across 7 API routes. These now go through `getSqlForDurableStore()`, which reuses the SAME `resolveStoreMode` decision every `src/repositories/*` store already uses rather than re-implementing a second production check. The reuse is load-bearing: `isProductionRuntime` deliberately exempts `NEXT_PHASE=phase-production-build`, because `next build` runs page-data collection under NODE_ENV=production while serving nothing. A naive `process.env.NODE_ENV === "production"` test here would have failed the BUILD instead of protecting a request path. 2. LOCALBLOBSTORE. It writes document bytes to a container-local disk while `document-capture-service` registers an artifact pointer claiming the bytes are stored — durable object storage silently swapped for ephemeral disk. It is the default blob store for both the capture and extraction services. In production it now raises DEPENDENCY_UNAVAILABLE (capability blocked: no ST0RE bytes path exists yet) instead of fabricating success. Asserted per-operation, not in the constructor, so merely wiring the services is not fatal — only actually persisting or reading bytes is. Evidence: full suite 956 passed / 184 skipped, typecheck clean, dependency-cruiser 0 errors, lint identical to main's pre-existing baseline (17 problems, none in changed files). Both guards asserted in both directions and mutation-tested: bypassing resolveStoreMode -> 2 failed; dropping the write assert -> 2 failed; dropping the read assert -> 1 failed; all restored -> 8 passed. 7 non-test call sites. DEPLOYMENT NOTE: merging changes no runtime (no Gitea webhook exists on any repo; deploys are manual). Deploying this build REQUIRES provisioning DATABASE_URL for 0pt first, or the order/subscription routes will correctly return DEPENDENCY_UNAVAILABLE instead of silently accepting orders into memory. That provisioning is a Simon action. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-09 17:38:51 +02:00
admin	2d34cb1629	feat(P-001, P-002): 0pt→N0D quality delegation + internal OpenAPI	2026-09-08 22:38:47 +02:00
admin	3edc56dcdb	fix: slutgranskning av dataset/search/ER-ytorna + STATUS-sanning ... Slutgate inför merge (per fortsättningsplan): Kontrakt: CreateDatasetVersionInput.artifact_refs → readonly string[] (anropare får skicka 'as const'; servicen muterar aldrig); postgres.js tx.array() får muterbar kopia vid INSERT. Testkorrigeringar (stale mot starkare implementation — aldrig svagare): - entity-resolution-http: request(body, undefined) triggade default-param och skickade GILTIGT token → 200. Tomt token = 'utan token' → 401 fail-closed. - entity-resolution: /two records/ → /between 2 and 5000/ (bounds-aware validering) - search-service: omformat purpose-filter-test + NY negativ kontroll — rebuild avvisar dokument utan purpose_tags (fail closed, generation discarded) - dataset-postgres.realinfra: sätter DATABASE_URL i setup så den durabla AUD0-outboxen aktiveras (testet ljög annars om durabilitet) — 5/5 mot live Postgres STATUS.md: AUD0-klient + lineage-rader (outbox nu real-infra testad), gap-listan (persistence/routes/outbox stängda, exakt vad som återstår), P065 STÄNGD med closure-record (thin adapter, v3-semantik, hard-negative transitivitet, fail-closed 401 — 4/4 planpunkter verifierade). Verifierat: typecheck EXIT 0 · 945/945 unit · 5/5 real-Postgres · next build EXIT 0	2026-09-07 19:31:22 +02:00
admin	35a8ff0f2a	feat: add generic ER composition root	2026-09-07 18:18:02 +02:00
admin	243918a255	feat: harden canonical ER service and idempotent batch submission	2026-09-07 18:17:52 +02:00
admin	00e4636655	refactor: centralize ER request validation	2026-09-07 18:16:43 +02:00
admin	f3a8cf6cc2	feat: add production search composition root	2026-09-07 18:11:31 +02:00
admin	82f7475b91	fix: audit only newly created durable search definitions	2026-09-07 18:11:06 +02:00
admin	8dfd429a61	refactor: return stable creation metadata for search definition audit	2026-09-07 18:10:13 +02:00
admin	9961ac7e03	refactor: make search definitions restart-safe	2026-09-07 18:09:05 +02:00
admin	dd01fe76c9	feat: add durable versioned search definition repository	2026-09-07 18:08:09 +02:00
admin	70fd81dc4d	feat: share durable dataset services across route modules	2026-09-07 18:06:21 +02:00
admin	3c5850fbe5	refactor: persist dataset versions and make lineage retry-stable	2026-09-07 18:03:21 +02:00
admin	3ccdcf0cf6	fix: use postgres arrays and normalized idempotency comparison	2026-09-07 18:02:38 +02:00